CVE-2024-48919: Cursor terminal command generation prompt injection via imported web page

Summary

CVE-2024-48919 affects Cursor, a code editor built for programming with AI. Before September 27, 2024, an attacker controlling a web page that a user explicitly imported into the Terminal Cmd-K prompt could influence a language model to output arbitrary commands for execution in the user's terminal. Exploitation required the user to opt in to including the compromised page's contents and the attacker to embed prompt injection text in that page.

Mitigation

A server-side patch stopped streaming back newlines or control characters, released September 27, 2024. Cursor 0.42 adds client-side mitigations that prevent newlines or control characters from being streamed into the terminal directly, and a new setting, "cursor.terminal.usePreviewBox", which when set to true streams the response into a preview box that must be manually accepted before insertion into the terminal. The server-side patch applies to older versions of Cursor, so no additional action is needed for it. Cursor's maintainers also recommend including only trusted pieces of context in prompts.

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)